feat(nix): move the forge host options under services.hyperhive.swarm

Forgejo is a swarm-global service, so its operator-facing host options
move to services.hyperhive.swarm.forge (and .swarm.forge.ci) as the
first of the namespace consolidation.

Existing hive configs keep evaluating: swarm-renames.nix maps every
moved leaf with mkRenamedOptionModule, which also emits a deprecation
warning naming both the old and new path, so an operator is told what to
rename rather than discovering it from a failed eval.

The per-agent hyperhive.forge.url does NOT move. It is a client pointer
at whatever forge an agent talks to - it shares a word with the service
and nothing else, and the two are already documented as separate option
surfaces.

Verified by evaluating the host module, since no Rust gate evaluates
nix: setting the old paths and reading the new ones yields the values
(httpPort 3999, ci.concurrency 7), and config.warnings carries the
rename notice.

nix/host-modules/swarm-renames.nix

@@ -0,0 +1,52 @@
+# Backwards-compatibility aliases for options that moved under
+# `services.hyperhive.swarm.*` when the swarm-global services were
+# consolidated into one namespace.
+#
+# `mkRenamedOptionModule` maps the old path to the new one *and* emits a
+# deprecation warning naming both, so an existing hive keeps evaluating and
+# its operator is told exactly what to rename. That is the whole reason the
+# move is safe to make in one commit: nothing has to be edited in lockstep.
+#
+# ⚠️ Only options that are genuinely **swarm-global** belong here. The
+# per-agent `hyperhive.forge.url` (`nix/agent-modules/forge.nix`) is a
+# client pointer at whatever forge an agent talks to — it shares a word with
+# the service and nothing else, and it does not move.
+{ lib, ... }:
+let
+  # One entry per moved leaf. Written as a list rather than a fold over the
+  # option tree on purpose: a rename has to name both paths explicitly, and
+  # deriving them would make an accidental rename invisible in review.
+  renamed = old: new: lib.mkRenamedOptionModule old new;
+
+  forgeOption =
+    name:
+    renamed [ "services" "hyperhive" "forge" name ] [ "services" "hyperhive" "swarm" "forge" name ];
+
+  forgeCiOption =
+    name:
+    renamed
+      [ "services" "hyperhive" "forge" "ci" name ]
+      [ "services" "hyperhive" "swarm" "forge" "ci" name ];
+in
+{
+  imports =
+    map forgeOption [
+      "httpPort"
+      "sshPort"
+      "domain"
+      "publicUrl"
+      "package"
+      "behindGateway"
+      "rootUrl"
+      "openFirewall"
+      "mirrors"
+    ]
+    ++ map forgeCiOption [
+      "enable"
+      "name"
+      "concurrency"
+      "labels"
+      "package"
+      "jobTimeout"
+    ];
+}